Nov 13 19:07:41 ms-srv sshd[59646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Nov 13 19:07:43 ms-srv sshd[59646]: Failed password for invalid user chuq from 193.70.86.97 port 44946 ssh2

fraudulent SSH attempt

Nov 27 12:52:22 tdfoods sshd\[12600\]: Invalid user clazar from 193.70.86.97
Nov 27 12:52:22 tdfoods sshd\[12600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu
Nov 27 12:52:24 tdfoods sshd\[12600\]: Failed password for invalid user clazar from 193.70.86.97 port 50926 ssh2
Nov 27 12:58:15 tdfoods sshd\[13024\]: Invalid user nybakk from 193.70.86.97
Nov 27 12:58:15 tdfoods sshd\[13024\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu

Nov 23 06:10:44 SilenceServices sshd[8673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Nov 23 06:10:47 SilenceServices sshd[8673]: Failed password for invalid user guest from 193.70.86.97 port 56490 ssh2
Nov 23 06:14:06 SilenceServices sshd[9596]: Failed password for root from 193.70.86.97 port 35892 ssh2

[ssh] SSH attack

Nov 16 05:52:34 jane sshd[17919]: Failed password for root from 193.70.86.97 port 44922 ssh2
...

Nov 14 18:30:30 vpn01 sshd[6216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Nov 14 18:30:32 vpn01 sshd[6216]: Failed password for invalid user hassan from 193.70.86.97 port 57320 ssh2
...

2019-10-26T16:13:01.421211scmdmz1 sshd\[12008\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu  user=root
2019-10-26T16:13:03.248484scmdmz1 sshd\[12008\]: Failed password for root from 193.70.86.97 port 57228 ssh2
2019-10-26T16:16:49.605112scmdmz1 sshd\[12330\]: Invalid user radames from 193.70.86.97 port 39334
...

2019-10-21T21:42:31.649000abusebot-3.cloudsearch.cf sshd\[24236\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu  user=root

Oct 21 13:39:22 MK-Soft-VM7 sshd[3361]: Failed password for root from 193.70.86.97 port 56816 ssh2
...

(sshd) Failed SSH login from 193.70.86.97 (FR/France/97.ip-193-70-86.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 21 05:26:21 server2 sshd[23850]: Failed password for root from 193.70.86.97 port 38268 ssh2
Oct 21 05:40:28 server2 sshd[24221]: Failed password for root from 193.70.86.97 port 49698 ssh2
Oct 21 05:43:57 server2 sshd[24281]: Failed password for root from 193.70.86.97 port 60848 ssh2
Oct 21 05:47:34 server2 sshd[24405]: Failed password for root from 193.70.86.97 port 43754 ssh2
Oct 21 05:51:13 server2 sshd[24502]: Invalid user clock from 193.70.86.97 port 54916

2019-10-05T13:43:23.028333shield sshd\[2891\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu  user=root
2019-10-05T13:43:25.241615shield sshd\[2891\]: Failed password for root from 193.70.86.97 port 52584 ssh2
2019-10-05T13:47:25.461429shield sshd\[3326\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu  user=root
2019-10-05T13:47:27.901723shield sshd\[3326\]: Failed password for root from 193.70.86.97 port 35928 ssh2
2019-10-05T13:51:24.325268shield sshd\[3895\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.ip-193-70-86.eu  user=root

Sep 30 09:54:22 fr01 sshd[1483]: Invalid user Eemil from 193.70.86.97
...

Sep 29 06:32:10 SilenceServices sshd[31342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Sep 29 06:32:12 SilenceServices sshd[31342]: Failed password for invalid user mapp from 193.70.86.97 port 48254 ssh2
Sep 29 06:36:07 SilenceServices sshd[32426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

Sep 24 06:04:18 MK-Soft-VM7 sshd[2096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97 
Sep 24 06:04:20 MK-Soft-VM7 sshd[2096]: Failed password for invalid user hct from 193.70.86.97 port 52882 ssh2
...

Sep 11 23:57:47 icinga sshd[19747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Sep 11 23:57:49 icinga sshd[19747]: Failed password for invalid user gitolite3 from 193.70.86.97 port 57022 ssh2
...

Sep  4 18:29:28 server sshd\[28193\]: User root from 193.70.86.97 not allowed because listed in DenyUsers
Sep  4 18:29:28 server sshd\[28193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97  user=root
Sep  4 18:29:30 server sshd\[28193\]: Failed password for invalid user root from 193.70.86.97 port 53796 ssh2
Sep  4 18:33:40 server sshd\[754\]: Invalid user dumpy from 193.70.86.97 port 41034
Sep  4 18:33:40 server sshd\[754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

2019-09-03T07:58:02.119520abusebot-2.cloudsearch.cf sshd\[563\]: Invalid user ftpuser from 193.70.86.97 port 60960

Aug 30 00:59:18 server sshd\[2866\]: Invalid user dark from 193.70.86.97 port 35610
Aug 30 00:59:18 server sshd\[2866\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Aug 30 00:59:20 server sshd\[2866\]: Failed password for invalid user dark from 193.70.86.97 port 35610 ssh2
Aug 30 01:02:59 server sshd\[12563\]: Invalid user ton from 193.70.86.97 port 60338
Aug 30 01:02:59 server sshd\[12563\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

Aug 24 02:54:50 SilenceServices sshd[14073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Aug 24 02:54:52 SilenceServices sshd[14073]: Failed password for invalid user tao from 193.70.86.97 port 52206 ssh2
Aug 24 02:54:52 SilenceServices sshd[14102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

Aug 20 10:27:55 game-panel sshd[13343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Aug 20 10:27:57 game-panel sshd[13343]: Failed password for invalid user ample from 193.70.86.97 port 40588 ssh2
Aug 20 10:31:51 game-panel sshd[13505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

Aug 19 07:10:52 vps200512 sshd\[30828\]: Invalid user astral from 193.70.86.97
Aug 19 07:10:52 vps200512 sshd\[30828\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97
Aug 19 07:10:54 vps200512 sshd\[30828\]: Failed password for invalid user astral from 193.70.86.97 port 59082 ssh2
Aug 19 07:14:57 vps200512 sshd\[30889\]: Invalid user jake from 193.70.86.97
Aug 19 07:14:57 vps200512 sshd\[30889\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.97

2019-08-19T00:14:04.443121abusebot-6.cloudsearch.cf sshd\[26271\]: Invalid user jboss from 193.70.86.97 port 38018

Aug 18 01:00:08 meumeu sshd[32057]: Failed password for invalid user tinda from 193.70.86.97 port 53278 ssh2
Aug 18 01:03:57 meumeu sshd[32509]: Failed password for invalid user testuser123 from 193.70.86.97 port 42448 ssh2
...

2019-08-16T22:08:35.233334abusebot-3.cloudsearch.cf sshd\[12820\]: Invalid user user from 193.70.86.97 port 54008

5 failures

Jun  7 09:06:23 nlmail01.srvfarm.net webmin[1210169]: Non-existent login as oracle from 193.70.86.108
Jun  7 09:06:24 nlmail01.srvfarm.net webmin[1210172]: Non-existent login as oracle from 193.70.86.108
Jun  7 09:06:26 nlmail01.srvfarm.net webmin[1210175]: Non-existent login as oracle from 193.70.86.108
Jun  7 09:06:30 nlmail01.srvfarm.net webmin[1210178]: Non-existent login as oracle from 193.70.86.108
Jun  7 09:06:34 nlmail01.srvfarm.net webmin[1210181]: Non-existent login as oracle from 193.70.86.108

WEB Remote Command Execution via Shell Script -1.a

blacklist username nextcloud
Invalid user nextcloud from 193.70.86.236 port 49912

Aug  7 22:21:03 ms-srv sshd[43002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.86.236
Aug  7 22:21:05 ms-srv sshd[43002]: Failed password for invalid user ushare from 193.70.86.236 port 49920 ssh2

Aug 03 07:09:57 askasleikir sshd[8566]: Failed password for invalid user anathan from 193.70.86.236 port 51320 ssh2

" "

Invalid user tarmo from 150.136.193.165 port 62310

Invalid user arnold from 154.66.113.78 port 56872

37215/tcp
[2019-08-16]1pkt

Aug 16 09:31:25 mail sshd[25078]: Invalid user admin from 165.22.7.99
Aug 16 09:31:25 mail sshd[25078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.7.99
Aug 16 09:31:25 mail sshd[25078]: Invalid user admin from 165.22.7.99
Aug 16 09:31:27 mail sshd[25078]: Failed password for invalid user admin from 165.22.7.99 port 40298 ssh2
Aug 16 09:39:45 mail sshd[26063]: Invalid user esadmin from 165.22.7.99
...

\[2019-08-16 08:45:08\] NOTICE\[23191\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"601" \' failed for '80.211.221.137:5439' \(callid: 886638000\) - Failed to authenticate
\[2019-08-16 08:45:08\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-08-16T08:45:08.978+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="886638000",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/80.211.221.137/5439",Challenge="1565937908/b5c255e169892ea5c27fec7d46fda0ba",Response="05491e2e473f03265e3b7862f952ad8b",ExpectedResponse=""
\[2019-08-16 08:45:09\] NOTICE\[29653\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"601" \' failed for '80.211.221.137:5439' \(callid: 886638000\) - Failed to authenticate
\[2019-08-16 08:45:09\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-08-16T08:45:09.027+0200",Severi

Aug 16 10:37:16 MK-Soft-Root2 sshd\[16209\]: Invalid user viktor from 187.183.84.178 port 35954
Aug 16 10:37:16 MK-Soft-Root2 sshd\[16209\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.183.84.178
Aug 16 10:37:18 MK-Soft-Root2 sshd\[16209\]: Failed password for invalid user viktor from 187.183.84.178 port 35954 ssh2
...

fail2ban

8080/tcp
[2019-08-16]1pkt

Automatic report - Banned IP Access

ssh failed login

445/tcp
[2019-08-16]1pkt

Splunk® : port scan detected:
Aug 16 05:24:34 testbed kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:c0:42:d0:39:2c:30:08:00 SRC=162.220.165.170 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=54321 PROTO=TCP SPT=43821 DPT=8088 WINDOW=65535 RES=0x00 SYN URGP=0

Aug 16 11:56:31 yabzik sshd[24373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.121.198.205
Aug 16 11:56:33 yabzik sshd[24373]: Failed password for invalid user bi from 40.121.198.205 port 38828 ssh2
Aug 16 12:02:13 yabzik sshd[27829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.121.198.205

Aug 16 05:14:28 raspberrypi sshd\[6561\]: Invalid user abi from 81.247.24.89Aug 16 05:14:30 raspberrypi sshd\[6561\]: Failed password for invalid user abi from 81.247.24.89 port 57432 ssh2Aug 16 05:28:03 raspberrypi sshd\[6879\]: Invalid user teste from 81.247.24.89Aug 16 05:28:05 raspberrypi sshd\[6879\]: Failed password for invalid user teste from 81.247.24.89 port 44198 ssh2
...